QR code glossary · Security
Single-use QR code
Also called: One-time QR code
Definition
A single-use QR code is a code that a system accepts only once, such as an event ticket, coupon or one-time link, with the limit enforced by a server that marks the code’s ID as used, not by the printed pattern, which can be copied and scanned any number of times.
How it works
Each code carries a unique ID, either in a link or in the text the code holds. On the first valid scan, the server checks the ID, marks it as used and lets the holder in or applies the discount. Every later scan of the same ID gets an “already used” answer. The check has to be atomic, so two scans arriving at the same moment cannot both succeed.
Nothing in the QR code itself changes when it is used. A screenshot or photocopy decodes to exactly the same ID, so whoever presents it first wins. Systems that need more than that add other checks: a name or ID check at the door, a code that a ticketing app refreshes every few seconds so screenshots go stale, or a code tied to one signed-in account.
Why it matters
Decide what counts as a use. Merely opening a link is a weak trigger: chat apps fetch links to build previews, and some email security systems open every link in a message to scan it, which can burn a one-time link before its owner ever sees it. Robust systems ignore known preview bots or require a deliberate action, such as a staff scan at the door or a tap on a “Redeem” button.
Plan for the edge cases too: a guest who leaves and comes back, a coupon scanned by mistake, a phone that died in the queue. Clear messages (“used at 7:42 pm at the north entrance”) and a way for staff to override make the difference between a secure system and a frustrating one.
In CirculateQR
One-time codes, on Studio and higher plans, work exactly once, and link-preview bots don’t use them up. Event registration issues QR tickets with a check-in screen for the door.
Related terms
- QuishingQuishing (QR code phishing) is a phishing attack that uses a QR code to send people to a malicious website, typically a fake login or payment page, often by sticking a fraudulent code over a genuine one or by putting a code in an email where link filters cannot inspect it.
- Dynamic QR codeA dynamic QR code is a QR code that encodes a short link to a redirect service instead of the final content, so the destination can be changed after printing and each scan can be counted, for as long as the service keeps the link active.
- RedirectA redirect is an HTTP response with a 3xx status code and a Location header that tells the browser to load a different address; it is how a dynamic QR code’s short link forwards each scan to the code’s current destination.
- Scan analyticsScan analytics are the records a dynamic QR code’s redirect service keeps each time the code is scanned, typically the time, an approximate location from the IP address, the device, operating system, browser and language, summarized into counts and charts.
- Unique scansUnique scans are an estimate of how many different people or devices scanned a QR code, counting repeat scans from the same scanner once, as opposed to total scans, which count every scan.
Learn more
- One-time codes, passwords and gates: Security controls for dynamic codes.
- Event registration and ticket check-in: QR tickets and door check-in.
- QR codes for events: Tickets, check-in and stopping duplicate entry.
Last updated . Written by the CirculateQR team. Example codes and sizes are computed with the open-source qrcode encoder that CirculateQR uses. Spotted something wrong? Email support@circulateqr.com. QR Code is a registered trademark of DENSO WAVE INCORPORATED.
← Browse the full glossary